CVE-2026-23835

The file upload feature in Knowledge Base > File Upload does not validate the integrity of the upload request, allowing users to intercept and modify the request parameters. As a result, it is possible to create arbitrary files in abnormal or unintended paths. In addition, since lobechat.com relies on the size parameter from the request to calculate file usage, an attacker can manipulate this value to misrepresent the actual file size, such as uploading a 1 GB file while reporting it as 10 MB, or falsely declaring a 10 MB file as a 1 GB file.

Details

After entering the Knowledge Base, click the file upload option and upload any file. At this point, use a tool such as Burp Suite to intercept and inspect the request sent to POST /trpc/lambda/file.createFile?batch=1 (the request packet is shown in the image below). By modifying the name and size fields in this request, it is possible to bypass the maximum upload size enforced by LobeChat’s monthly subscription plan and upload files beyond the intended service storage limits.

Impacts

By manipulating the size value provided in the client upload request, it is possible to bypass the monthly upload quota enforced by the server and continuously upload files beyond the intended storage and traffic limits. This abuse can result in a discrepancy between actual resource consumption and billing calculations, causing direct financial impact to the service operator. Additionally, exhaustion of storage or related resources may lead to degraded service availability, including failed uploads, delayed content delivery, or temporary suspension of upload functionality for legitimate users. A single malicious user can also negatively affect other users or projects sharing the same subscription plan, effectively causing an indirect denial of service (DoS). Furthermore, excessive and unaccounted-for uploads can distort monitoring metrics and overload downstream systems such as backup processes, malware scanning, and media processing pipelines, ultimately undermining overall operational stability and service reliability

PoC

Kodem intelligence

1. What is CVE-2026-23835? CVE-2026-23835 is a medium-severity security vulnerability in @lobehub/chat (npm), affecting versions < 1.143.3. It is fixed in 1.143.3.
2. Which versions of @lobehub/chat are affected by CVE-2026-23835? @lobehub/chat (npm) versions < 1.143.3 is affected.
3. Is there a fix for CVE-2026-23835? Yes. CVE-2026-23835 is fixed in 1.143.3. Upgrade to this version or later.
4. Is CVE-2026-23835 exploitable, and should I be worried? Whether CVE-2026-23835 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-23835 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-23835? Upgrade @lobehub/chat to 1.143.3 or later.